pipefy-pipes-and-cards
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
pipefyCLI commands (e.g.,pipefy pipe create,pipefy card move) to perform operations. These are standard management actions for the Pipefy platform. - [DATA_EXPOSURE_AND_EXFILTRATION]: While the skill includes an attachment upload tool (
upload_attachment_to_card), it notes thatfile_urlinputs are SSRF-guarded andfile_pathis restricted to local profiles, which are standard security controls for this vendor's infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided data for card and pipe creation. It mitigates injection risks by recommending the use of
introspect_typeto validate field types and using structured JSON for field updates rather than raw string interpolation.
Audit Metadata